Certificate authentication bindings and limitations
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d3da066 · +14 −9 lines · also on GitHub
⋯ 52 unchanged lines
5353
>
5454
> Make sure that turning off TLS inspection also works for issuer hints with the new URL. Don't hard-code the URL with the tenant ID. The tenant ID might change for business-to-business (B2B) users. Use a regular expression to allow both the previous URL and the new URL to work when you turn off TLS inspection. For example, depending on the proxy, use `*.certauth.login.microsoftonline.com` or `*certauth.login.microsoftonline.com`. In Azure Government, use `*.certauth.login.microsoftonline.us` or `*certauth.login.microsoftonline.us`.
5555
56
− Unless access is allowed, CBA fails if you turn on [issuer hints](#issuer-hints-preview).
56
+ Unless access is allowed, CBA fails if you turn on [issuer hints](#issuer-hints).
5757
5858
1. Microsoft Entra ID requests a client certificate. The user selects the client certificate, and then selects **OK**.
5959
⋯ 5 unchanged lines
6565
6666
If user sign-in is successful, the user can access the application.
6767
68
−## Issuer hints (preview)
68
+## Issuer hints
6969
7070
Issuer hints send back a *trusted CA* indicator as part of the TLS handshake. The trusted CA list is set to the subject of the CAs that the tenant uploads to the Microsoft Entra trust store. A browser client or native application client can use the hints that the server sends back to filter the certificates shown in the certificate picker. The client shows only the authentication certificates issued by the CAs in the trust store.
7171
⋯ 28 unchanged lines
100100
- CBA (first factor) and [passkeys](../authentication/how-to-enable-authenticator-passkey.md) (second factor)
101101
- CBA (first factor) and [passwordless phone sign-in](../authentication/howto-authentication-passwordless-phone.md#enable-passwordless-phone-sign-in-authentication-methods) (second factor)
102102
- CBA (first factor) and [FIDO2 security keys](../authentication/howto-authentication-passwordless-security-key-windows.md) (second factor)
103
−- Password (first factor) and CBA (second factor) (preview)
103
+- Password (first factor) and CBA (second factor)
104104
105105
> [!NOTE]
106106
> Currently, using CBA as a second factor on iOS has [known issues](./concept-certificate-based-authentication-mobile-ios.md#known-issues) and is blocked on iOS. We're working to resolve the issues.
⋯ 310 unchanged lines
417417
Ensure that CBA in each tenant is configured with the username bindings pointing to the `certificateUserIds` field for the field types that you mapped from the certificate. Now any of these users can present the certificate at sign-in. After the unique value from the certificate is validated against the `certificateUserIds` field, the user is successfully signed in.
418418
419419
420
−## Certificate Authority (CA) Scoping (Preview)
420
+## Certificate Authority (CA) Scoping
421421
422422
CA scoping in Microsoft Entra allows tenant administrators to restrict the use of specific CAs to defined user groups. This feature enhances the security and manageability of CBA by ensuring that only authorized users can authenticate by using certificates issued by specific CAs.
423423
⋯ 222 unchanged lines
646646
## Related content
647647
648648
- [Overview of Microsoft Entra CBA](concept-certificate-based-authentication.md)
649
−- [Set up Microsoft Entra CBA](how-to-certificate-based-authentication.md)
649
+- [Technical deep dive for Microsoft Entra CBA](concept-certificate-based-authentication-technical-deep-dive.md)
650
+- [How to configure Microsoft Entra CBA](how-to-certificate-based-authentication.md)
650651
- [Microsoft Entra CBA Certificate Revocation List](concept-certificate-based-authentication-certificate-revocation-list.md)
651
−- [Microsoft Entra CBA on iOS devices](concept-certificate-based-authentication-mobile-ios.md)
652652
- [Microsoft Entra CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
653
−- [Windows smart card sign-in by using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
653
+- [Windows smart card logon using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
654654
- [Certificate user IDs](concept-certificate-based-authentication-certificateuserids.md)
655
−- [Migrate federated users](concept-certificate-based-authentication-migration.md)
655
+- [How to migrate federated users](concept-certificate-based-authentication-migration.md)
656656
- [FAQ](certificate-based-authentication-faq.yml)
657
−- [Troubleshoot Microsoft Entra CBA](./certificate-based-authentication-faq.yml)
657
+- [Microsoft Entra CBA Certificate Revocation List](concept-certificate-based-authentication-certificate-revocation-list.md)
658
+- [Microsoft Entra CBA on Android devices](concept-certificate-based-authentication-mobile-android.md)
659
+- [Windows smart card logon using Microsoft Entra CBA](concept-certificate-based-authentication-smartcard.md)
660
+- [Certificate user IDs](concept-certificate-based-authentication-certificateuserids.md)
661
+- [How to migrate federated users](concept-certificate-based-authentication-migration.md)
662
+- [FAQ](certificate-based-authentication-faq.yml)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.